berbew | b5e55080e150c196bd1ef5c7fa9bf7d9aa072f3b8d6079f3016ba5d9b0ef1eb9

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2024 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5e55080e150c196bd1ef5c7fa9bf7d9aa072f3b8d6079f3016ba5d9b0ef1eb9.exe
Size

337KB
MD5

fab6044dc97455813e546ae4a32a1238
SHA1

95cbb03144516674b078f67255d77a9c4e5078d2
SHA256

b5e55080e150c196bd1ef5c7fa9bf7d9aa072f3b8d6079f3016ba5d9b0ef1eb9
SHA512

5e39cfe45c1fd2ed6b05a33b8abd7a0f570032830c419775e8ec02c8a70504e94d8abbdb38d00ba266b91c35ccf4ff90d4c40638fb7b6817c962d885d1a56687
SSDEEP

3072:dewMFyNVITkEbgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc0l:KyPG5b1+fIyG5jZkCwi8j

Score

10^/10

berbew njrat backdoor discovery persistence trojan

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckkiccep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adfnofpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glgcbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hiipmhmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	b5e55080e150c196bd1ef5c7fa9bf7d9aa072f3b8d6079f3016ba5d9b0ef1eb9.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acfhad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eppjfgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hehkajig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mniallpq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qikgco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbdhiojo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bombmcec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpecbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lndagg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jljbeali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aopemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjlpjm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhcjqinf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nccokk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdpaeehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jiiicf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plndcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjkblhfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbbpmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnplfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnnkgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hibafp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijqmhnko.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jofalmmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgphpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oihagaji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qljcoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcejco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdhbmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phdnngdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alnfpcag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aajohjon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgpfbjlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpmdfonj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnaaib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoobdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnfiplog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Poajkgnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggahedjn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Naecop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eeelnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpelhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlpfhe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aanbhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Elnoopdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pknqoc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pajeam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpgind32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oiknlagg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pamiaboj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qebhhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkfglb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afpjel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agdcpkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Flfkkhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knqepc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lelchgne.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew
Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 64 IoCs

pid	Process
4440	Lbngllob.exe
3428	Lelchgne.exe
4824	Lijlof32.exe
3312	Maeachag.exe
4284	Mniallpq.exe
740	Mlmbfqoj.exe
1800	Meefofek.exe
1948	Mnnkgl32.exe
2240	Mlbkap32.exe
2412	Maodigil.exe
3812	Nobdbkhf.exe
1556	Nlfelogp.exe
4996	Neoieenp.exe
2032	Nliaao32.exe
4412	Nafjjf32.exe
2752	Nhpbfpka.exe
3480	Nlkngo32.exe
848	Nojjcj32.exe
4396	Nbefdijg.exe
3020	Niooqcad.exe
1824	Nhbolp32.exe
4160	Nkqkhk32.exe
4564	Nolgijpk.exe
1036	Nbgcih32.exe
3028	Nefped32.exe
4064	Niakfbpa.exe
4536	Nhdlao32.exe
1472	Okchnk32.exe
4936	Oondnini.exe
4424	Objpoh32.exe
3440	Oampjeml.exe
428	Oidhlb32.exe
2424	Ohghgodi.exe
3680	Olbdhn32.exe
432	Okedcjcm.exe
1028	Ooqqdi32.exe
4188	Oblmdhdo.exe
2936	Oekiqccc.exe
4324	Oifeab32.exe
632	Ohiemobf.exe
2504	Oldamm32.exe
4884	Oocmii32.exe
1672	Oboijgbl.exe
3344	Oemefcap.exe
1496	Oihagaji.exe
752	Ohkbbn32.exe
3388	Okjnnj32.exe
4804	Ooejohhq.exe
3624	Oadfkdgd.exe
5032	Oeoblb32.exe
1656	Oiknlagg.exe
4504	Olijhmgj.exe
2616	Oklkdi32.exe
3396	Oohgdhfn.exe
4540	Oafcqcea.exe
4532	Oeaoab32.exe
3436	Oimkbaed.exe
4348	Pllgnl32.exe
3128	Pojcjh32.exe
3684	Pahpfc32.exe
4000	Pedlgbkh.exe
1944	Piphgq32.exe
628	Plndcl32.exe
3092	Pkadoiip.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fjmkoeqi.exe	Fllkqn32.exe
File created	C:\Windows\SysWOW64\Hffpdd32.dll	Pkegpb32.exe
File created	C:\Windows\SysWOW64\Ockkandf.dll	Qhkdof32.exe
File created	C:\Windows\SysWOW64\Iikmbh32.exe	Iepaaico.exe
File opened for modification	C:\Windows\SysWOW64\Pmblagmf.exe	Pnplfj32.exe
File opened for modification	C:\Windows\SysWOW64\Nlfelogp.exe	Nobdbkhf.exe
File opened for modification	C:\Windows\SysWOW64\Aojlaeei.exe	Allpejfe.exe
File created	C:\Windows\SysWOW64\Cpgbgamd.dll	Bcddcbab.exe
File created	C:\Windows\SysWOW64\Fmpbqoqg.dll	Cjnffjkl.exe
File created	C:\Windows\SysWOW64\Dikihe32.exe	Djhimica.exe
File created	C:\Windows\SysWOW64\Jbecoe32.dll	Qoelkp32.exe
File created	C:\Windows\SysWOW64\Aahbbkaq.exe	Aafemk32.exe
File created	C:\Windows\SysWOW64\Cdecba32.dll	Dmadco32.exe
File created	C:\Windows\SysWOW64\Fmcjpl32.exe	Fihnomjp.exe
File created	C:\Windows\SysWOW64\Ncqlkemc.exe	Npepkf32.exe
File created	C:\Windows\SysWOW64\Fnoimo32.dll	Fllkqn32.exe
File created	C:\Windows\SysWOW64\Efpgoecp.dll	Hbhijepa.exe
File created	C:\Windows\SysWOW64\Bhnikc32.exe	Boeebnhp.exe
File opened for modification	C:\Windows\SysWOW64\Bhkfkmmg.exe	Baannc32.exe
File created	C:\Windows\SysWOW64\Ejdeelde.dll	Bhamkipi.exe
File created	C:\Windows\SysWOW64\Jdqlliil.dll	Cjliajmo.exe
File created	C:\Windows\SysWOW64\Chnidloo.dll	Bdickcpo.exe
File created	C:\Windows\SysWOW64\Jdgccn32.dll	Efeihb32.exe
File opened for modification	C:\Windows\SysWOW64\Kgdpni32.exe	Jedccfqg.exe
File created	C:\Windows\SysWOW64\Kncaec32.exe	Kflide32.exe
File created	C:\Windows\SysWOW64\Kofmfi32.dll	Omnjojpo.exe
File created	C:\Windows\SysWOW64\Knhcpa32.dll	Oocmii32.exe
File created	C:\Windows\SysWOW64\Gghpel32.dll	Qhlkilba.exe
File created	C:\Windows\SysWOW64\Akffafgg.exe	Ahgjejhd.exe
File opened for modification	C:\Windows\SysWOW64\Jqknkedi.exe	Jjafok32.exe
File created	C:\Windows\SysWOW64\Jedccfqg.exe	Jgbchj32.exe
File created	C:\Windows\SysWOW64\Lmnbjama.dll	Palklf32.exe
File created	C:\Windows\SysWOW64\Ciipkkdj.dll	Bdfpkm32.exe
File created	C:\Windows\SysWOW64\Dpkmal32.exe	Dnmaea32.exe
File opened for modification	C:\Windows\SysWOW64\Pojcjh32.exe	Pllgnl32.exe
File opened for modification	C:\Windows\SysWOW64\Bedgjgkg.exe	Bkobmnka.exe
File created	C:\Windows\SysWOW64\Egbcih32.dll	Iepaaico.exe
File opened for modification	C:\Windows\SysWOW64\Pdmdnadc.exe	Ppahmb32.exe
File created	C:\Windows\SysWOW64\Hlohlk32.dll	Aaoaic32.exe
File created	C:\Windows\SysWOW64\Oeoblb32.exe	Oadfkdgd.exe
File opened for modification	C:\Windows\SysWOW64\Qohpkf32.exe	Qljcoj32.exe
File opened for modification	C:\Windows\SysWOW64\Ejalcgkg.exe	Efepbi32.exe
File created	C:\Windows\SysWOW64\Embddb32.exe	Epndknin.exe
File created	C:\Windows\SysWOW64\Ladfllde.dll	Hdehni32.exe
File created	C:\Windows\SysWOW64\Ljclki32.exe	Lcjcnoej.exe
File opened for modification	C:\Windows\SysWOW64\Mcecjmkl.exe	Madjhb32.exe
File created	C:\Windows\SysWOW64\Mogcihaj.exe	Modgdicm.exe
File opened for modification	C:\Windows\SysWOW64\Aoioli32.exe	Ahofoogd.exe
File created	C:\Windows\SysWOW64\Ddgibkpc.exe	Dpkmal32.exe
File created	C:\Windows\SysWOW64\Ckpbnb32.exe	Cjnffjkl.exe
File created	C:\Windows\SysWOW64\Kdflmg32.dll	Pknqoc32.exe
File created	C:\Windows\SysWOW64\Fdllgpbm.dll	Lflbkcll.exe
File created	C:\Windows\SysWOW64\Mlbkap32.exe	Mnnkgl32.exe
File created	C:\Windows\SysWOW64\Lalbjhdj.dll	Pojcjh32.exe
File created	C:\Windows\SysWOW64\Jcphdpff.dll	Igbalblk.exe
File created	C:\Windows\SysWOW64\Lqmmmmph.exe	Lfgipd32.exe
File created	C:\Windows\SysWOW64\Gfkbde32.exe	Gjdaodja.exe
File created	C:\Windows\SysWOW64\Feoodn32.exe	Fpbflg32.exe
File created	C:\Windows\SysWOW64\Nadleilm.exe	Nnfpinmi.exe
File created	C:\Windows\SysWOW64\Gdmpga32.dll	Oghghb32.exe
File created	C:\Windows\SysWOW64\Enfqikef.dll	Pmblagmf.exe
File created	C:\Windows\SysWOW64\Ahdpjn32.exe	Apmhiq32.exe
File opened for modification	C:\Windows\SysWOW64\Oeaoab32.exe	Oafcqcea.exe
File created	C:\Windows\SysWOW64\Bljlfh32.exe	Bjlpjm32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12248	11692	WerFault.exe	618

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bddjpd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhamkipi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckmehb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idfaefkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffceip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lndagg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Peahgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blnoga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpcapp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgclpkac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdpaeehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkceokii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmabggdm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pajeam32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lflbkcll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paiogf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oimkbaed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aoalgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffqhcq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahofoogd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfaemp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjfmkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ackbmcjl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pddhbipj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chnbbqpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flmqlg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bphgeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Maeachag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oklkdi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pidabppl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdqfll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lijlof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbelcblk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljqhkckn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akffafgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iggjga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfcabp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pemomqcn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afkknogn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhmbqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohghgodi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgeghp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jiiicf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpfgmnfp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pllgnl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffclcgfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffcpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dijbno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oampjeml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqmmmmph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cijpahho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjdaodja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcpojd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojgjndno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oihagaji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bochmn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdecgbfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bahdob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phedhmhi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlieda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnfgcd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhdlao32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igbalblk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnqfcbnj.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Efjbcakl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Niooqcad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phincl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acmobchj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmabggdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgehfkop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qaalblgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Blnoga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fpbflg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jgbchj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mogcihaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfpcoefj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Objpoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijnmaj32.dll"	Phganm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ioenpjfm.dll"	Bmabggdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acpklg32.dll"	Codhnb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjmkoeqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Doaneiop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmcjpl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfhgkmpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oafcqcea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcpojd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Idfaefkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkconn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njinmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkemhahj.dll"	Nenbjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmohno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qdbpmock.dll"	Ccbadp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdecba32.dll"	Dmadco32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phcgcqab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bphgeo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oboijgbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckmehb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnkbcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfglfdkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahofoogd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdfpkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olijhmgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djhimica.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Efepbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmeoam32.dll"	Kmieae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Famcfn32.dll"	Lqikmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbnnhndk.dll"	Phdnngdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fijgdejm.dll"	Oampjeml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpkajf32.dll"	Oeoblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlkbjqgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khblgpag.dll"	Dnmhpg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnpdegjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpefcn32.dll"	Ilcldb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omjbpn32.dll"	Dnmaea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nolgijpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkmkkjko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fihgkk32.dll"	Lqmmmmph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojhpimhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glfdiedd.dll"	Dhbebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kckefh32.dll"	Plndcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Glcaambb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igpoaebh.dll"	Poliea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Poliea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekaapi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gddedlaq.dll"	Lpfgmnfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdmpga32.dll"	Oghghb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdglmkeg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 4440	3352	b5e55080e150c196bd1ef5c7fa9bf7d9aa072f3b8d6079f3016ba5d9b0ef1eb9.exe	83
PID 3352 wrote to memory of 4440	3352	b5e55080e150c196bd1ef5c7fa9bf7d9aa072f3b8d6079f3016ba5d9b0ef1eb9.exe	83
PID 3352 wrote to memory of 4440	3352	b5e55080e150c196bd1ef5c7fa9bf7d9aa072f3b8d6079f3016ba5d9b0ef1eb9.exe	83
PID 4440 wrote to memory of 3428	4440	Lbngllob.exe	84
PID 4440 wrote to memory of 3428	4440	Lbngllob.exe	84
PID 4440 wrote to memory of 3428	4440	Lbngllob.exe	84
PID 3428 wrote to memory of 4824	3428	Lelchgne.exe	85
PID 3428 wrote to memory of 4824	3428	Lelchgne.exe	85
PID 3428 wrote to memory of 4824	3428	Lelchgne.exe	85
PID 4824 wrote to memory of 3312	4824	Lijlof32.exe	86
PID 4824 wrote to memory of 3312	4824	Lijlof32.exe	86
PID 4824 wrote to memory of 3312	4824	Lijlof32.exe	86
PID 3312 wrote to memory of 4284	3312	Maeachag.exe	87
PID 3312 wrote to memory of 4284	3312	Maeachag.exe	87
PID 3312 wrote to memory of 4284	3312	Maeachag.exe	87
PID 4284 wrote to memory of 740	4284	Mniallpq.exe	88
PID 4284 wrote to memory of 740	4284	Mniallpq.exe	88
PID 4284 wrote to memory of 740	4284	Mniallpq.exe	88
PID 740 wrote to memory of 1800	740	Mlmbfqoj.exe	89
PID 740 wrote to memory of 1800	740	Mlmbfqoj.exe	89
PID 740 wrote to memory of 1800	740	Mlmbfqoj.exe	89
PID 1800 wrote to memory of 1948	1800	Meefofek.exe	90
PID 1800 wrote to memory of 1948	1800	Meefofek.exe	90
PID 1800 wrote to memory of 1948	1800	Meefofek.exe	90
PID 1948 wrote to memory of 2240	1948	Mnnkgl32.exe	91
PID 1948 wrote to memory of 2240	1948	Mnnkgl32.exe	91
PID 1948 wrote to memory of 2240	1948	Mnnkgl32.exe	91
PID 2240 wrote to memory of 2412	2240	Mlbkap32.exe	92
PID 2240 wrote to memory of 2412	2240	Mlbkap32.exe	92
PID 2240 wrote to memory of 2412	2240	Mlbkap32.exe	92
PID 2412 wrote to memory of 3812	2412	Maodigil.exe	93
PID 2412 wrote to memory of 3812	2412	Maodigil.exe	93
PID 2412 wrote to memory of 3812	2412	Maodigil.exe	93
PID 3812 wrote to memory of 1556	3812	Nobdbkhf.exe	94
PID 3812 wrote to memory of 1556	3812	Nobdbkhf.exe	94
PID 3812 wrote to memory of 1556	3812	Nobdbkhf.exe	94
PID 1556 wrote to memory of 4996	1556	Nlfelogp.exe	95
PID 1556 wrote to memory of 4996	1556	Nlfelogp.exe	95
PID 1556 wrote to memory of 4996	1556	Nlfelogp.exe	95
PID 4996 wrote to memory of 2032	4996	Neoieenp.exe	96
PID 4996 wrote to memory of 2032	4996	Neoieenp.exe	96
PID 4996 wrote to memory of 2032	4996	Neoieenp.exe	96
PID 2032 wrote to memory of 4412	2032	Nliaao32.exe	97
PID 2032 wrote to memory of 4412	2032	Nliaao32.exe	97
PID 2032 wrote to memory of 4412	2032	Nliaao32.exe	97
PID 4412 wrote to memory of 2752	4412	Nafjjf32.exe	98
PID 4412 wrote to memory of 2752	4412	Nafjjf32.exe	98
PID 4412 wrote to memory of 2752	4412	Nafjjf32.exe	98
PID 2752 wrote to memory of 3480	2752	Nhpbfpka.exe	99
PID 2752 wrote to memory of 3480	2752	Nhpbfpka.exe	99
PID 2752 wrote to memory of 3480	2752	Nhpbfpka.exe	99
PID 3480 wrote to memory of 848	3480	Nlkngo32.exe	100
PID 3480 wrote to memory of 848	3480	Nlkngo32.exe	100
PID 3480 wrote to memory of 848	3480	Nlkngo32.exe	100
PID 848 wrote to memory of 4396	848	Nojjcj32.exe	101
PID 848 wrote to memory of 4396	848	Nojjcj32.exe	101
PID 848 wrote to memory of 4396	848	Nojjcj32.exe	101
PID 4396 wrote to memory of 3020	4396	Nbefdijg.exe	102
PID 4396 wrote to memory of 3020	4396	Nbefdijg.exe	102
PID 4396 wrote to memory of 3020	4396	Nbefdijg.exe	102
PID 3020 wrote to memory of 1824	3020	Niooqcad.exe	103
PID 3020 wrote to memory of 1824	3020	Niooqcad.exe	103
PID 3020 wrote to memory of 1824	3020	Niooqcad.exe	103
PID 1824 wrote to memory of 4160	1824	Nhbolp32.exe	104

C:\Users\Admin\AppData\Local\Temp\b5e55080e150c196bd1ef5c7fa9bf7d9aa072f3b8d6079f3016ba5d9b0ef1eb9.exe
"C:\Users\Admin\AppData\Local\Temp\b5e55080e150c196bd1ef5c7fa9bf7d9aa072f3b8d6079f3016ba5d9b0ef1eb9.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\SysWOW64\Lbngllob.exe
  C:\Windows\system32\Lbngllob.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\SysWOW64\Lelchgne.exe
    C:\Windows\system32\Lelchgne.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\SysWOW64\Lijlof32.exe
      C:\Windows\system32\Lijlof32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4824
    - - C:\Windows\SysWOW64\Maeachag.exe
        
        C:\Windows\system32\Maeachag.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3312
      - C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Windows\SysWOW64\Nhpbfpka.exe
        
        C:\Windows\system32\Nhpbfpka.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2752
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\Windows\SysWOW64\Nojjcj32.exe
        
        C:\Windows\system32\Nojjcj32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:848
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4396
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\SysWOW64\Nkqkhk32.exe
        
        C:\Windows\system32\Nkqkhk32.exe
        23⤵
        Executes dropped EXE
        
        PID:4160
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4564
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        25⤵
        Executes dropped EXE
        
        PID:1036
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        26⤵
        Executes dropped EXE
        
        PID:3028
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        27⤵
        Executes dropped EXE
        
        PID:4064
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        29⤵
        Executes dropped EXE
        
        PID:1472
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        30⤵
        Executes dropped EXE
        
        PID:4936
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4424
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3440
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        33⤵
        Executes dropped EXE
        
        PID:428
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2424
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        35⤵
        Executes dropped EXE
        
        PID:3680
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        36⤵
        Executes dropped EXE
        
        PID:432
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        37⤵
        Executes dropped EXE
        
        PID:1028
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        38⤵
        Executes dropped EXE
        
        PID:4188
        
        C:\Windows\SysWOW64\Oekiqccc.exe
        
        C:\Windows\system32\Oekiqccc.exe
        39⤵
        Executes dropped EXE
        
        PID:2936
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        40⤵
        Executes dropped EXE
        
        PID:4324
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        41⤵
        Executes dropped EXE
        
        PID:632
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        42⤵
        Executes dropped EXE
        
        PID:2504
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4884
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1672
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        45⤵
        Executes dropped EXE
        
        PID:3344
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1496
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        47⤵
        Executes dropped EXE
        
        PID:752
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        48⤵
        Executes dropped EXE
        
        PID:3388
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        49⤵
        Executes dropped EXE
        
        PID:4804
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3624
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5032
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1656
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4504
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2616
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        55⤵
        Executes dropped EXE
        
        PID:3396
        
        C:\Windows\SysWOW64\Oafcqcea.exe
        
        C:\Windows\system32\Oafcqcea.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4540
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        57⤵
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3436
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4348
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3128
        
        C:\Windows\SysWOW64\Pahpfc32.exe
        
        C:\Windows\system32\Pahpfc32.exe
        61⤵
        Executes dropped EXE
        
        PID:3684
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        62⤵
        Executes dropped EXE
        
        PID:4000
        
        C:\Windows\SysWOW64\Piphgq32.exe
        
        C:\Windows\system32\Piphgq32.exe
        63⤵
        Executes dropped EXE
        
        PID:1944
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:628
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        65⤵
        Executes dropped EXE
        
        PID:3092
        
        C:\Windows\SysWOW64\Pchlpfjb.exe
        
        C:\Windows\system32\Pchlpfjb.exe
        66⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        67⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        68⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:4588
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        70⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        71⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4736
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:636
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        74⤵
        Modifies registry class
        
        PID:3696
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        75⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1072
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        77⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        78⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        79⤵
        Modifies registry class
        
        PID:5084
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        80⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\Pocfpf32.exe
        
        C:\Windows\system32\Pocfpf32.exe
        81⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\Pcobaedj.exe
        
        C:\Windows\system32\Pcobaedj.exe
        82⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Pemomqcn.exe
        
        C:\Windows\system32\Pemomqcn.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        84⤵
        Drops file in System32 directory
        
        PID:1564
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        85⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        86⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        87⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2384
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4008
        
        C:\Windows\SysWOW64\Qohpkf32.exe
        
        C:\Windows\system32\Qohpkf32.exe
        90⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        91⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5156
        
        C:\Windows\SysWOW64\Ahqddk32.exe
        
        C:\Windows\system32\Ahqddk32.exe
        93⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        94⤵
        Drops file in System32 directory
        
        PID:5244
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        95⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5332
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        97⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        98⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Alnmjjdb.exe
        
        C:\Windows\system32\Alnmjjdb.exe
        99⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        100⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        101⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        102⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        103⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        104⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Ackbmcjl.exe
        
        C:\Windows\system32\Ackbmcjl.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:5700
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5740
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        107⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        108⤵
        Drops file in System32 directory
        
        PID:5820
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:5860
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        110⤵
        Modifies registry class
        
        PID:5900
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:5940
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        112⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Acokhc32.exe
        
        C:\Windows\system32\Acokhc32.exe
        113⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        114⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6112
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4620
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        117⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        118⤵
        Drops file in System32 directory
        
        PID:1628
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        119⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        120⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1664
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        121⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5132
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5188
        
        C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        124⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        125⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5284
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        126⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        127⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        128⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        130⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        131⤵
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        132⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        133⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5776
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        135⤵
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        136⤵
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        137⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4448
        
        C:\Windows\SysWOW64\Ccdnjp32.exe
        
        C:\Windows\system32\Ccdnjp32.exe
        138⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        139⤵
        Drops file in System32 directory
        
        PID:5984
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        140⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        141⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        142⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        143⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        144⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        145⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        146⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        147⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        148⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        150⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        151⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        152⤵
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        153⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        154⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5980
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        156⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        157⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4092
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        158⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        159⤵
        Drops file in System32 directory
        
        PID:5200
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        160⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        161⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        162⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        164⤵
        Drops file in System32 directory
        
        PID:1312
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        165⤵
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:6080
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        167⤵
        Modifies registry class
        
        PID:1592
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        168⤵
        Modifies registry class
        
        PID:5196
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        169⤵
        
        PID:820
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        170⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        171⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2524
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        172⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        173⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        174⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5916
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        176⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5652
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        178⤵
        Drops file in System32 directory
        
        PID:3112
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        179⤵
        Drops file in System32 directory
        
        PID:1772
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:728
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        181⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        182⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        183⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        184⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6272
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        185⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6356
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        187⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        188⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        189⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        190⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6520
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6560
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        192⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        193⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6648
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        194⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        195⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:6780
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        197⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        198⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        199⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        200⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        201⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        202⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        203⤵
        Drops file in System32 directory
        
        PID:7092
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        204⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        205⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        206⤵
        Modifies registry class
        
        PID:6220
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        207⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        208⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        209⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        210⤵
        Modifies registry class
        
        PID:6512
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        211⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6660
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        213⤵
        Modifies registry class
        
        PID:6728
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        214⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        215⤵
        Drops file in System32 directory
        
        PID:6876
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        216⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        217⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        218⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        219⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        220⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6364
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        222⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6612
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        224⤵
        Drops file in System32 directory
        
        PID:6704
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        225⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        226⤵
        Modifies registry class
        
        PID:6964
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        227⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        228⤵
        System Location Discovery: System Language Discovery
        
        PID:7164
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        229⤵
        Modifies registry class
        
        PID:6352
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        230⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        231⤵
        Modifies registry class
        
        PID:6756
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        232⤵
        Modifies registry class
        
        PID:6928
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        233⤵
        System Location Discovery: System Language Discovery
        
        PID:7104
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6432
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6656
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        236⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        237⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        238⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        239⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        240⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        241⤵
        System Location Discovery: System Language Discovery
        
        PID:7076
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        242⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        243⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        244⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        245⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        246⤵
        System Location Discovery: System Language Discovery
        
        PID:7244
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:7328
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        248⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7416
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        250⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        251⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        252⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        253⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        254⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        255⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        256⤵
        Modifies registry class
        
        PID:7720
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        257⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7808
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7852
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7896
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        261⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        262⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        263⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        264⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        265⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        266⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        267⤵
        Drops file in System32 directory
        
        PID:7184
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        268⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        269⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        270⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        271⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        272⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        273⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        274⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        275⤵
        Modifies registry class
        
        PID:7776
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        276⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        277⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        278⤵
        Drops file in System32 directory
        
        PID:7992
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        279⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        280⤵
        Drops file in System32 directory
        
        PID:8124
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        281⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        282⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        283⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        284⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        285⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        286⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        287⤵
        Drops file in System32 directory
        
        PID:7860
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        288⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8112
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7212
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7424
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        292⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        293⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        294⤵
        System Location Discovery: System Language Discovery
        
        PID:7932
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        295⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        296⤵
        System Location Discovery: System Language Discovery
        
        PID:7240
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        297⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7820
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        299⤵
        Drops file in System32 directory
        
        PID:7928
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        300⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        301⤵
        Modifies registry class
        
        PID:7880
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:7412
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        303⤵
        Drops file in System32 directory
        
        PID:8004
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        304⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        305⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7728
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        306⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        307⤵
        System Location Discovery: System Language Discovery
        
        PID:8264
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        308⤵
        Drops file in System32 directory
        
        PID:8308
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        309⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        310⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        311⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        312⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        313⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        314⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        315⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        316⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        317⤵
        System Location Discovery: System Language Discovery
        
        PID:8712
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        318⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        319⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        320⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        321⤵
        System Location Discovery: System Language Discovery
        
        PID:8888
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        322⤵
        Modifies registry class
        
        PID:8936
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        323⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        324⤵
        Modifies registry class
        
        PID:9024
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        325⤵
        Modifies registry class
        
        PID:9068
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        326⤵
        Modifies registry class
        
        PID:9120
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        327⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        328⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8204
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        329⤵
        System Location Discovery: System Language Discovery
        
        PID:8304
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        330⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        331⤵
        Modifies registry class
        
        PID:8428
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        332⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        333⤵
        System Location Discovery: System Language Discovery
        
        PID:8568
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        334⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        335⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        336⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        337⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        338⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8992
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        340⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        341⤵
        Drops file in System32 directory
        
        PID:9148
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        342⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        343⤵
        Modifies registry class
        
        PID:8324
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8432
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        345⤵
        Modifies registry class
        
        PID:8584
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        346⤵
        Drops file in System32 directory
        
        PID:8652
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        347⤵
        Modifies registry class
        
        PID:8820
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7708
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        349⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9056
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        350⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        351⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        352⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8884
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        354⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        355⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        356⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        357⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        358⤵
        System Location Discovery: System Language Discovery
        
        PID:9280
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        359⤵
        System Location Discovery: System Language Discovery
        
        PID:9316
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        360⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        361⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        362⤵
        System Location Discovery: System Language Discovery
        
        PID:9456
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        363⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        364⤵
        System Location Discovery: System Language Discovery
        
        PID:9560
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        365⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        366⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        367⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        368⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        369⤵
        System Location Discovery: System Language Discovery
        
        PID:9812
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        370⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        371⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        372⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        373⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10056
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10100
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10148
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        377⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        378⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        379⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        380⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9428
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9496
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9572
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        384⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        385⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        386⤵
        Modifies registry class
        
        PID:9848
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        387⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9936
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        389⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        390⤵
        Drops file in System32 directory
        
        PID:10096
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        391⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        392⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        393⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        394⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        395⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        396⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        397⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        398⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        399⤵
        Modifies registry class
        
        PID:9904
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        400⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        401⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10204
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        403⤵
        System Location Discovery: System Language Discovery
        
        PID:9340
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9480
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        405⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9800
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9732
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        407⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        408⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10212
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        409⤵
        Drops file in System32 directory
        
        PID:9348
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        410⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        411⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        412⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        413⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9604
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        414⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        415⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10252
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        417⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        418⤵
        Drops file in System32 directory
        
        PID:10348
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        419⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        420⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        421⤵
        Modifies registry class
        
        PID:10480
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        422⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10524
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        423⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        424⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        425⤵
        System Location Discovery: System Language Discovery
        
        PID:10660
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        426⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        427⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        428⤵
        Drops file in System32 directory
        
        PID:10788
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        429⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10840
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        430⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        431⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10940
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        432⤵
        Drops file in System32 directory
        
        PID:10984
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        433⤵
        Modifies registry class
        
        PID:11028
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        434⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11116
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        436⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        437⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        438⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        439⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        440⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        441⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        442⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        443⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        444⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        445⤵
        Drops file in System32 directory
        
        PID:10668
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        446⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        447⤵
        Drops file in System32 directory
        
        PID:10824
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        448⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        449⤵
        System Location Discovery: System Language Discovery
        
        PID:10992
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        450⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        451⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        452⤵
        System Location Discovery: System Language Discovery
        
        PID:11228
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10344
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        454⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        455⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        456⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        457⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        458⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10776
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        459⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        460⤵
        Modifies registry class
        
        PID:10976
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        461⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        462⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        463⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9964
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        464⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        465⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        466⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        467⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        468⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        469⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        470⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        471⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        472⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        473⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        474⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        475⤵
        System Location Discovery: System Language Discovery
        
        PID:11428
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        476⤵
        Modifies registry class
        
        PID:11472
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        477⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        478⤵
        Drops file in System32 directory
        
        PID:11568
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        479⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        480⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        481⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11704
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        482⤵
        Drops file in System32 directory
        
        PID:11748
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        483⤵
        Drops file in System32 directory
        
        PID:11812
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        484⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        485⤵
        System Location Discovery: System Language Discovery
        
        PID:11904
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        486⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        487⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        488⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        489⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        490⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12132
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        491⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        492⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        493⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12260
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        494⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        495⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        496⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        497⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11484
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        498⤵
        Drops file in System32 directory
        
        PID:11552
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        499⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        500⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        501⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11712
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        502⤵
        Drops file in System32 directory
        
        PID:11800
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        503⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        504⤵
        Drops file in System32 directory
        
        PID:11944
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        505⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        506⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        507⤵
        System Location Discovery: System Language Discovery
        
        PID:12116
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        508⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12168
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        509⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        510⤵
        System Location Discovery: System Language Discovery
        
        PID:10580
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        511⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11288
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        512⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        513⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        514⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11624
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        515⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11656
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        516⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        517⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        518⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        519⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        520⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        521⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12172
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        522⤵
        Drops file in System32 directory
        
        PID:12244
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        523⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        524⤵
        Modifies registry class
        
        PID:11408
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        525⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11692 -s 404
        526⤵
        Program crash
        
        PID:12248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 11692 -ip 11692
1⤵
PID:11972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ahofoogd.exe

Filesize
337KB

MD5
89417ac017961b514eeb27d1a782b1e4

SHA1
00e891708e008200a4ea11fb2691057afbb67703

SHA256
036cd7d177839fdc8d4416f7f6a4a70c0a2d6f14ca96e8d8138e9e0229980c60

SHA512
5cd1a66976cc19752b942a947f26e3e21bc25163b26c4473c8b6664f4ef2b839745e1325e475ed5194dc26a2f6994bed853d3e142cbddd93381dfa55083e9f56

Download Submit
C:\Windows\SysWOW64\Alnfpcag.exe

Filesize
337KB

MD5
37bb873dada4ff047d0e40c191de31ba

SHA1
28e06305d32281eeea4c67dca4ad0b04e5fb51f7

SHA256
99ffef5d58846bef013e3548d66fcd8ae4fb643e9424f14ffb2915802dbfc277

SHA512
79552887ab25d562bffba16cb7fa152d65f245f83c5e0c731ae1413b4e03bf11e3534315b8f6ab615e710dc99a1a7dfc0402f8b9eeea510111abaeb58a067a40

Download Submit
C:\Windows\SysWOW64\Bddjpd32.exe

Filesize
337KB

MD5
7a14a96fa9926fce83d9754a1e1c30a9

SHA1
f66d9cf272e1f437a8aaa85d3924dfe04a8d838b

SHA256
39d27bb724e7444b00c11780cb3a9dc9b77d64581b7c2c0ca886b9d3a70250e0

SHA512
972a9319d93e1e3e433ee4b472a0e4d27266a837fd81b94e90b956f222474e067852808fed98881ae70361c5410f5e05ce6525baa98e2d30241ee0dc252968f0

Download Submit
C:\Windows\SysWOW64\Bffcpg32.exe

Filesize
337KB

MD5
21018710716699745c46c70461ffc200

SHA1
9239e445fc26e418b81d46239ffc46b4970568dd

SHA256
2d9b6db16b9c04c58758df0377f4ae3db938009f0f9410c52f46c898fcdd603c

SHA512
a3a68dfeaf3519bc5d0149692ccc583a80c014e26cfb0e408df64e2b2d5af54bd28296ff33d94727095a392c2c06085d0dd1175c10ccbfd4b8013c4737e66af5

Download Submit
C:\Windows\SysWOW64\Bhamkipi.exe

Filesize
337KB

MD5
7a86d0bdd3d40355d2a20c572e16ead3

SHA1
703ede98cc8abbc9d085bde3407ecd181a2f1fe5

SHA256
483287e389fa0024edb1bfd718688ea479d430045d86cfecae0a0b99f933ec91

SHA512
73786e5e88a7cbe51a355ef03712684cfe378a44f1aad72d18c08763907ae61bc40b89f1870aaf94fefde9e5522210a6cae121ce84fdd649322464d567cd50c3

Download Submit
C:\Windows\SysWOW64\Bhcjqinf.exe

Filesize
337KB

MD5
e6cb21ce95c194c183b5ca964ea860fa

SHA1
1181c05600f9a7b29dab2cfd28097bfbded1b241

SHA256
01e8b39be7ff0abda80f09fddee197b95f661a8d5c86b783f49e42b3561d17fa

SHA512
3e50468d78409c8e9186b5add5fad2eb7630d0406c993bb44da0e207f3375e32b15d303be99031850debd9d9c15f74715804cd7c04fa4612cc2ab7760565f103

Download Submit
C:\Windows\SysWOW64\Blnoga32.exe

Filesize
337KB

MD5
ecbbae976fcfa50b4c419eb7cd8f7733

SHA1
53b53b9856585519e4239893c3852c8a7255fe98

SHA256
a2af533fd34a73b862579c7ce05a5482a15568fa9c6ec3153b68d1fb64ebc589

SHA512
84bbd1d8aeb489b2d49cffa13ebe9376ac02fe40cd8a9c49c0da4259477ef89d879d3e94284df4c974d588a29bca20d41447047c4ab6c388b5744186c2660c31

Download Submit
C:\Windows\SysWOW64\Bochmn32.exe

Filesize
337KB

MD5
cbf00e1056da81e11d983ecdf933231a

SHA1
1b0e31d16899fdf609c9f571a0243685aeec56c9

SHA256
35ee9149fdc3dece8189708cb4d04f3e8e44f89118d9ce61a8563088d3ff423e

SHA512
ea5a6239b911e2014e873a289f4120a48120c050308b02b589a1594e2e579bc63e2947cb896196cc18f9f4258fc3202ea372518f733d79b2d41ce8920fd81c59

Download Submit
C:\Windows\SysWOW64\Boeebnhp.exe

Filesize
337KB

MD5
d003be6dddec35021b54fee841f6bcbe

SHA1
b64b67c1cc35d05749b1fd021c6352253ac24119

SHA256
4f132b07370f3406fdc254177dbb4b1cc14ddfeb9c4ca23bd3c9b7bafef42b4a

SHA512
3126785970a19bb5e4a84a609e88bd1d5bb80e93875fdf654aaff83e5b216c63ead5b1b21b1982bdf6f2350fe282a158275adeff166fd87c40ae41dab91f09dc

Download Submit
C:\Windows\SysWOW64\Boldhf32.exe

Filesize
337KB

MD5
bbf0ea5e1c213e12696e5b92e4ec45b4

SHA1
233a4d75bdefe492a258f9bcea52a4592a839481

SHA256
fa84ab6efe1831c07d8383851891248c2fda0eb1f2405c1a9d19fd5113a22983

SHA512
70fd4253971ae6e22ec1cf9fa7973dfa171159fc5d08f20c4fb6993a62ed13b35a72d7d8c8f79e6ef824ba89e7a42effabfe7e4c19346f2ba2b91988e1ea4f7f

Download Submit
C:\Windows\SysWOW64\Bopocbcq.exe

Filesize
337KB

MD5
ac25ffbb01af22c8027196a88df6901c

SHA1
094494a5388467768931f805dc13801272c416e4

SHA256
4e375a0bf50d4e4282105dae0af95cb5f99293a6f85f0252fdb0682c98cc5a77

SHA512
37d818624ff9f4a609b2d7513dda16c180c758394f957e938f44876d44157f7c4374f13840b2c7e7dac537617eb28dcc3d1695ab3ee40e9e042f88ff2ae834df

Download Submit
C:\Windows\SysWOW64\Cbdjeg32.exe

Filesize
337KB

MD5
13fed7ee7f61627e6e11157ccfa3cabe

SHA1
f30ad0ec9858fb726109b9d7949626745ad74ae4

SHA256
70f33d4c615fe07543b13233b2d762f37dc6fa80eeb52fae4dbe3edfe66a0188

SHA512
f8ca50094bc01a53bf2d8f021486b604c7b2dd54e4b21fa7a176267964a468115b9f057f62a1d5f4e3031d5f8f2c703f1968168bc9d71eabe65b3e5ecb166151

Download Submit
C:\Windows\SysWOW64\Ccdnjp32.exe

Filesize
337KB

MD5
8c3ea55bbe0567219387249e10b291c7

SHA1
7df7b5f51d2d2e24af29d5395404162c49afa93c

SHA256
6292f7e1ae2566fc47a8ef3cb62f2117fbdda82f20ee01f34da10b361381d8bf

SHA512
7cb26e82a4019c80d1dff05e849d4f2f2f1053dd3c117fc6d564283054e3aeb9fa95dc79603a9f058b9769a39522216264eedbdbecd156a47418fcc7a735c9c6

Download Submit
C:\Windows\SysWOW64\Chglab32.exe

Filesize
337KB

MD5
ca096742b27851f72034059976060f2c

SHA1
d0d9214d1bbec3f28abdeeb784440a92b85c6676

SHA256
d6344463be8895a19d2491023384fa68154682f57de574e1e064081567e4a9b8

SHA512
88f05a2e63a9ce8a03d4bf7ca5572e9f9473ac12d21b0a28323b695052d1fa0e874e41b51408dd52c943692bd90d62461895e21bbf9d29ae5cec17b916021b14

Download Submit
C:\Windows\SysWOW64\Ckebcg32.exe

Filesize
337KB

MD5
b62653ecd75ed04f62c4ad16861d6fb7

SHA1
b88fa1431a183d2f1384d4933f0612916c8bc8fb

SHA256
e36613bd675cb60c312e3039c4a15582acbec88132983056ead834e96ea13ac1

SHA512
76ab97223932d0af0346fb473f8045c92d16ef2763a10c3aaccb2c35d96b94966a1793ae5d4c559f0c8b881a9cdaa54dc7d9dd2faf1ec75c06a69bcef50299ba

Download Submit
C:\Windows\SysWOW64\Dfnbgc32.exe

Filesize
337KB

MD5
559b7b7f6d65ac2f7c897ce875d7969d

SHA1
c25d153da28f83b797795bdd02e0bc6168503c51

SHA256
35df526ab330affeafb5099b37fa1582c770845e3f30fb3844468cb60f146808

SHA512
73d131588de3874b0b3573bd640a5383777a6b856a3ba15e8a2e6cb16f73330705d99dc9a134b33a2cb3f5d9f9f47834b1124605e25544a3ed83ce7f8224265d

Download Submit
C:\Windows\SysWOW64\Dnmhpg32.exe

Filesize
337KB

MD5
37caca8cffa77eef4923208ba5538e0f

SHA1
10979680d90071dfcd1d91ad393e04e6559497cc

SHA256
6c56ca5bf95914734737915de5686d11c18cb3c9a0378db9862e13d760b90599

SHA512
61bdf00778bfd0cc1d57791f01c6c090ef9d444520edafe2ecd470aa9b132d2ea56b53d034f90951c293a07208349aaba5d81dbe5afb9db54e521cf261f90a2a

Download Submit
C:\Windows\SysWOW64\Ebejfk32.exe

Filesize
337KB

MD5
c66ab3c632ed28687fcf8984742da574

SHA1
d14665d1430ef7ec23c39d0c0cbf03fc5853defd

SHA256
2c38bddf35617231afbaf88ad327259bc8139ee8c26483397c6c1b6ff804f623

SHA512
a699ee25e362cd0cda54e4ab1a32482196002f22c0b67921145ff6aafa96868b1ab7e7d19b5d1ef441213cd7f68e95fb2b5565abf200234a48830da49cb1f81d

Download Submit
C:\Windows\SysWOW64\Ejalcgkg.exe

Filesize
337KB

MD5
f70f317df44f8a10fd521d0fc4d1c84b

SHA1
be993f8a7d22334ed527fefcdf14ffb0bf1dde6c

SHA256
853be25aa2235ba6a413cce86972e5cfb94b4f04b51e4bf8177d60e481be7ad8

SHA512
070b9acc036003038924892d6138e7bc77944a2cb8fed64897c8364d449f4fd6065aeec05d7b1e8ca3fd8ad4c348e59396353e0efa504ddd9b33d9ffb10f42cb

Download Submit
C:\Windows\SysWOW64\Ekaapi32.exe

Filesize
337KB

MD5
0a9b9381bbd9af8afed815a8e3b59eb6

SHA1
8d5161e0ce567418dc514d7ccdc0962735192c7d

SHA256
233034ad8ce866ddba82b65346d6691e9395a05d593b71450da90e9d6eb23340

SHA512
c5925d278314d4cf2be6060dddf0631a9e8eef446aff835c31a7ff2cde56e0220538e650a19c978e0b3859511f375be768f979dcaecef8aeb894425ad2c0f84f

Download Submit
C:\Windows\SysWOW64\Embddb32.exe

Filesize
337KB

MD5
783e30639a4f99584b988b74bfa4903e

SHA1
8ded0ab56f4900988531f5e58d2f34cf63f7dbf3

SHA256
38d542b6cf4e16dd7626be54fd2e38397d80def44bea895289a8e4665d87e78b

SHA512
6b0ee326c9da62a0d517dd6e7a198ddca38953f15ff5f3c6f0c4893257cd9aaa8df660de9a265a1b1edc08de371344b8d0ffd9e76d9a8c093953b83234acbe1a

Download Submit
C:\Windows\SysWOW64\Enkdaepb.exe

Filesize
337KB

MD5
02a9007e702988f0a3b3d5f9f696e6d4

SHA1
56e15a859d4df3a45704c19d600a454a5f8602a3

SHA256
79b7a10a8a7f85699fe292fb147e71ea2b209808ba166db707178536348356e3

SHA512
cd77009181bb460eefa8db214f9ce19e2f7e2da86e71da24478c8c168ad4d9f7e216f54aae61f0f7ee7bcd659648c1a5f80b405fbc1c9696dc1697cf0e1b5607

Download Submit
C:\Windows\SysWOW64\Fjmkoeqi.exe

Filesize
337KB

MD5
33800428cb01900f9f310bd60c818036

SHA1
b36ee6ceb78144b91d53351a68d6b3614827a299

SHA256
331c98f345c37860737fcfbf97b35d80534676b1384a8e6e53c0639f328ca4da

SHA512
f34079d4fb7d5de27d09aa46e65c2f5ecc676c618d0c288924c4020e0ba0d2435096d5b60164f8651d46a035d208926d7f8f25d1c5a31fe6e745bbaa44866d04

Download Submit
C:\Windows\SysWOW64\Fmkqpkla.exe

Filesize
337KB

MD5
82d4c2097ef146b1f3b5593f80d63e15

SHA1
61415811b63603069202bb168c8d6ef94b157837

SHA256
0907d37991cfebb9e412e1f6a84b44f0ac3a227ae8ad25695267fa1abf5a7afd

SHA512
31715631728968348d5967c9958bd763b9e61242d8afaad74369a556e2966c5482a7c39eab2a4eb389d31abfa46d9f1f350a1b50ad80dc242cbd4903a9fe9a53

Download Submit
C:\Windows\SysWOW64\Fpkibf32.exe

Filesize
320KB

MD5
e192420fb90d30bfebb63a7e392c06e5

SHA1
cc14f50505d4a05c0919d933122718087b508914

SHA256
fc4e7095f42d5e15a57031c2c5523c643d1f4c8f05deef9a1cdab2bc9bea62ea

SHA512
4a0d3d934bd38fde54831a379d87f5ba9692c49df4336ce46979fb3218da8c88a31be35d4a0bb19fd3c75206cff627dba58566ae8b556e8aeb815c1cad12be13

Download Submit
C:\Windows\SysWOW64\Gejopl32.exe

Filesize
337KB

MD5
5915fce90aaa06b2129a1b2bcfaeb198

SHA1
de59a1e203dc6936fff2fef02940574edfb61f16

SHA256
0a242a42d345c543d064f7be11f1852b0091c9967163d06fa8cf57603d0de236

SHA512
daa55c6e10e008d7b48db8466a32f0c2f4efa2e6b3b376892489141e8f5a0db54839daa80431d7334fe8297419f6ab5854efca842f95b17c0acb2e4fd8d83431

Download Submit
C:\Windows\SysWOW64\Gkhkjd32.exe

Filesize
337KB

MD5
a5f03fc54759e99368d4eea4a2220c90

SHA1
30a519027f0301f66a7b33ec9b138190c57af0f4

SHA256
e4df490af861f88b30ff43b24280b247cb110aa6f72786c4d39875acd19286cd

SHA512
c1ec0dd66e6249a7f993ef10bfe9cc67ed1f2dc95428fca4d52c5f0311a94ad21f9afdac26b3e67afe28fd11df91e930ad287cbb6c8c5082815504b4a8c8fbae

Download Submit
C:\Windows\SysWOW64\Gmiclo32.exe

Filesize
337KB

MD5
61af1e4a4cf5d287f9aec220c8fb048d

SHA1
6f6f18b7bdc65e72a5b6473fcd033548dbead90d

SHA256
98aba924a752a3bb785b35bf4eef87b18093a01ee185ec02dd23303e66f14632

SHA512
de52428496035b3bb8e0cd52f36563d43df67c19941b28052d42b079fbf57b51660299f822550569f4212ec27cae896108ac9b1960ea30e21a2c54d5c4f4ad09

Download Submit
C:\Windows\SysWOW64\Hdjbiheb.exe

Filesize
337KB

MD5
7e216700ba4152048efe41265b52e01a

SHA1
9a455b2a0168c0350b7e227a4bffcaf9b2f4623c

SHA256
5c130b4a68da6bf2316f3d1f26f8a5b0bcb96b10f85700e0ac0b9c09ba2320d0

SHA512
16ba22d11b2beed08c7994608cfb32c44d010ddf75ea6f375ebf5eeab72f08c556a2c492c40a5022c819e5e54f78420831d7dfd840bcf4b6f3d7b5c6f14b409d

Download Submit
C:\Windows\SysWOW64\Hkfglb32.exe

Filesize
337KB

MD5
8e72d2f1d4e888b9f62d89940e3c99e2

SHA1
8d2696fa8b806831e4aacbfaae4c6123e20adad8

SHA256
9aa85064fa561fcca8a7a66f22adaef50e3e27f601ed6a80e52cf842299be102

SHA512
d5c262ac56d223b63d69a87f77b8b5427bd7c0897256da84a73a91b5be0b80f3771008bc7bea6b389a678c3a55e7b598ef61379595e648267272ca55f8770f40

Download Submit
C:\Windows\SysWOW64\Hmbphg32.exe

Filesize
337KB

MD5
991cf0685ecb61dca67ec411ac3afd19

SHA1
741acc450f8db9fc90b4055187f098c50f82aa1a

SHA256
825733ffc6387408270fc79c2a6361443c3b1f3fb943e95a613c81c0b510ce72

SHA512
1d0e0e83a734a979e12b50145a208c164c02d209697651593b302e1b4b40eab64626c50cf83d0d4114f9a030958e7de77bf35822c94429b3c55be656aed88186

Download Submit
C:\Windows\SysWOW64\Hpchib32.exe

Filesize
64KB

MD5
7394f768ec20c69b97d4c9101e39ecae

SHA1
111712fa2d7ef83992872922ce5409180b2c20b6

SHA256
c0ddad80e36c6af674287796dd0a3ccd6b927d276fe78f2fb3b638eb52db16f3

SHA512
f94d578bb23536ba6980d5f3b1020806c68e736caeb25fb0d06ae849bfb7ead2494013d2c42542501399e2b08bd890d57425562291a5a480774ee22feb9d9ff4

Download Submit
C:\Windows\SysWOW64\Ifomll32.exe

Filesize
337KB

MD5
afaaa00981c1fa9c936031bc5fabcb9d

SHA1
0794e5add547af7969c1f91e7322a8f6c9531cd0

SHA256
2f8ab9129ede5fd8471e91e3fdbe2509cac35f061dae1d934bdd58a91c05134e

SHA512
afdf4fe0c10528b1e98dd07cd09cc41fc1329b5f0c2b10e33cf4c108366f6723558fbe5e16a03bdbf3d634b9f13ececdf8a080fae1fe7459b807e8ef74904613

Download Submit
C:\Windows\SysWOW64\Iplkpa32.exe

Filesize
337KB

MD5
5a38f589503ade11e4535756dfc6ac04

SHA1
0ecfb1ac75946f0dc8d4bee6b2e2c5d1e5326c64

SHA256
2d7ba11774e53557da30555913968aa12c13df056826bd2e030992f17cbf7e7f

SHA512
96cecaa1acf4f6ff32288cffce6bd7e6ea6d613d5304aeb681160ce0ed5baca56ce535171c3e42a777e8e2c047b7e55650887f7c127b3ae3bac3a815ded317b9

Download Submit
C:\Windows\SysWOW64\Jedccfqg.exe

Filesize
337KB

MD5
b7a8a65834937647eff83ad8e7631a70

SHA1
f818cb3691922f85c6026218bcf0d9a3bb5bf5d5

SHA256
e657169e231e00924e50ffc50a7059f1ca4515d81fb72ead4e9bc804d32ade97

SHA512
d6b958ebc36770756b5b0440c0a69fbf9ba6eb863aa52753c9e90fca4a98afe2d7c536e5b36b95fda99b3742032b650f600f44113c42359b48b501b0f8262657

Download Submit
C:\Windows\SysWOW64\Jgeghp32.exe

Filesize
337KB

MD5
74b8775f9fdd08144cc3f7ede19a4ad1

SHA1
bdb8fec0363f5e00b4f4c3f53f266ea7110398d2

SHA256
1971ad68214dd701f7ca21addb9336e18f8d75cb93218ff420bfd1aea77927d3

SHA512
07b82767b5122f1a11fadcfe1d936528903f93e9eead68cd74e555d1799fc9febe56e7d053735724f3cbd23a6b5e035e201372d01c24f0121c7297c5c8d644f8

Download Submit
C:\Windows\SysWOW64\Jjafok32.exe

Filesize
337KB

MD5
2fea631def540d0aa021df1df60e6bf0

SHA1
93104ee46f79c276cfdfcfe58f9b4036e33dd7cd

SHA256
32ce9f6eeaffca82599bb5f756cde32844ec5100e57396b66c1688afc1109466

SHA512
0f8f61d35dc376b9874030b6a1ac36c8fcb07fbccb03b5f6ddab07ec39461985cc9bc46a2f9e196b7bd33cc17c31f2e99253de20324bdfdb7e0e39a3792fc930

Download Submit
C:\Windows\SysWOW64\Jlfpdh32.exe

Filesize
337KB

MD5
682bb389337c9cc3e698adad182fb1a2

SHA1
4177f4f8b1a4a24535fbf35701b92e0791f0e3dd

SHA256
7f1d1080f67f49309d3e329b4cb2474136fb3f775a3fe20fb9d2d6160babd8f0

SHA512
b6ee55285c69b8cfda83dcc19fa5048f21533a11a550392bc91c03c3ac2b831eefcfab91be6b8678d0ba768c2b2bfa489b07629c0696781c38113af797863d81

Download Submit
C:\Windows\SysWOW64\Jljbeali.exe

Filesize
337KB

MD5
165c5a6c2fead32c91044b56c7c51797

SHA1
3cb295c1d87cddcb83d3e4732b517fb8f6458cfc

SHA256
3e0cbf67b59dbba262da14fea884141b97cfe7b7162a2e601b3e0c31e7f95ae1

SHA512
43ec4d315976ea1d3db0a07d430eb79ec78f8857cd4bc1d94c09ba2c2bf37753196928e54fce54fbedadc693293ad38b2c078d282e57a99bbc9a187c63a10dcc

Download Submit
C:\Windows\SysWOW64\Jniood32.exe

Filesize
337KB

MD5
a399bd9126b0154b52b0a6741d1c46d8

SHA1
a75dcda0ce9e27ced1c58f44d32a8053dfac5670

SHA256
b727116b891e85d099e19ff3634d1d85fab157a484a0e9323abb08b6fea4754d

SHA512
38c5714a330d178c0be200e3ceecefcaa74a0b75f971b2ff12a180626794195e45c6d4013b21324cfc26199ad38ac17187b25bbd7bf0db889e42949df61ad258

Download Submit
C:\Windows\SysWOW64\Kckqbj32.exe

Filesize
337KB

MD5
04176d693462de48fa069d21d62d259a

SHA1
b20b57384f3fc0b702bc0f028d0e024dfb602ab7

SHA256
8067f9cfd2159e55800e988bd4aa02291474a90f9011a95425f145df0efe8ea4

SHA512
715ab6b2ef37d75307765d61a22f957f73ed46f0e5362340b985d43f74c668315fb31b5641d49df53a2cbb91c80bc47c048393ecb64258af473ab2e71eaf3b0f

Download Submit
C:\Windows\SysWOW64\Kfpcoefj.exe

Filesize
337KB

MD5
d1e601715c88bdd16213e2498edcc836

SHA1
249c416b543b0614a9f4479a00f48ca03d4b394b

SHA256
877e69720306a9062ffcb60eeea328f14d29c5f01bc3aff905e734b12afd6a63

SHA512
e4aad7de0cbd24671b4fa2f28b2344e762bd9b15f57ce3a29ec165d9bd4e764c8ff793e0d8d17e785c655845ff6c82780602b2bef8f7245b817fd462676cfc26

Download Submit
C:\Windows\SysWOW64\Kkconn32.exe

Filesize
337KB

MD5
3e8e9f79b1be5053d1e9d322b998cb18

SHA1
ef21fe4768e290c686a5aa3df95c6f1d8755a974

SHA256
e50c61647bb2a20b7416521d4c066eb025263842f4b63b53435c095662ba5a2c

SHA512
2c5a3f600dddeb7454cd17c41730fbc12f46a14a80005d6a3a773de3b98028efd3b03f5b5e305a487f6faff41e026b137a073440ad1ffeabd60e5c9efda21e51

Download Submit
C:\Windows\SysWOW64\Kmieae32.exe

Filesize
337KB

MD5
63267ba6529bc2f506798e9ceca3193f

SHA1
986efc629fcba3ec3af2a99b6c7d066e41200a56

SHA256
af384a1aa095a5fc187e12ffffc1bb4f223c6bd37f9caf3076b3c83ca81979fc

SHA512
dfd740088afa7632dbf8c3943467a6c772504131cc50d279457f3cec53584777b99fc936fc7b2123f99df5a38329177b20d90414bbeaaa7e7273fe6f9f2ebfc4

Download Submit
C:\Windows\SysWOW64\Knqepc32.exe

Filesize
337KB

MD5
17b79c182ccc231dc82addb52fe1e0ec

SHA1
8c917abe25fb9c44f1c65a02c85424fa3de4bd3c

SHA256
075f537c4e2653a35e96a1266aefb45de18d32fb8087495d69200e97085ccbf3

SHA512
e214597ab774f8c3bf6616f3090a0779ccf2c89ad24eae02ef29ff03fdd547a17cb16acbddd02aeb01de718cce4d2ac3b14e0290ac66236e208ba1bcaeb4f3fb

Download Submit
C:\Windows\SysWOW64\Lbngllob.exe

Filesize
337KB

MD5
be3d8f19400db3e004a3f0a4ef3c829b

SHA1
6fd86f966c4b3a291fb7ef1620edbe94433f3803

SHA256
a1319d8a8d5adfac81960e45c003eff5ba11b730447d3a9037f15cf7080f46fb

SHA512
b212c1b7e10785b20d281bc69167c9a3130d8136dac662e0e070cb4453214411427b9dd86fa88dde03c3a3daf66c6fe33023577b3d3108effd0cfc0a259f46c4

Download Submit
C:\Windows\SysWOW64\Lcjcnoej.exe

Filesize
337KB

MD5
01afe1ed3c24ac337709eb7a26d1b802

SHA1
25aa6222cb74f43d9585b139abb4609a8daea56c

SHA256
e59293bcb1cc82e8a7ebec6ada4864286118090eb81ee502c027b047db0f0855

SHA512
bff14c7cb2308273583ea0c43ec681090b34347718a911a28399acdac73cd6cbc1ceca71db4727161bad65278b2bb4edbd2a265a23c9ed649e527ec00999b32e

Download Submit
C:\Windows\SysWOW64\Lelchgne.exe

Filesize
337KB

MD5
c679225815ea9af841b61a839b6de441

SHA1
59fec7120656bea054caa15de2556fc2bbd22160

SHA256
f6cecf1cf22a9536ebd943c7943eeb1524d7181656f5185bd76da6cd0f86c93b

SHA512
29576568f1b4ce454eff6085c8e8cf0506ad13782cb4ed39f8899bd4541fc9128737e1bc215d015465d313c782d400bdaaf82e9866c6158da0ffdcec17e451e7

Download Submit
C:\Windows\SysWOW64\Lgdidgjg.exe

Filesize
337KB

MD5
87b19114dd563553e9daa19066deb4a0

SHA1
2a1d7033f5baa03896681b6be4ab506f7d07a525

SHA256
773bf2e3b15616feb92e52cccab3f7bf9272a5e8a7641ebf5ff41967c5d95da4

SHA512
e6127454ab075011dfcaad081327784319917f91a90fe3a70bbb5578cc78282b06842f22b557563cadf79834e8899a0f5f1dfb865a5c3e2f2d8f250376690d9b

Download Submit
C:\Windows\SysWOW64\Lijlof32.exe

Filesize
337KB

MD5
984c2bc39f955b103257f445eb1595be

SHA1
b3d193a0f09e5bf6010aec2020f44cfe0869a011

SHA256
a834794a08730ff097ed441def16a44bb3954bd6e838408cf35ffecc30aa1702

SHA512
66541a7376758a221a4d8e41b459f0df028c2af5c7132ef8650fe7b1de09beb91c99486df3ae4e70c45e092b5dde9e3eef56eccc50e59cf2ede2b3ff5221a6b3

Download Submit
C:\Windows\SysWOW64\Llmhaold.exe

Filesize
337KB

MD5
d1d75983d3654906525b8900b785529c

SHA1
f0a06371bff1fe4e901eb6d0c6fb4b9e5b6717ac

SHA256
a49aa9d0903270faf8a08972d240edca70ecbaf5aac10be738724b24c09dfe45

SHA512
1d7cedface186d9c838046e1b83e9c9dfc1c72c5332fd1b40acf86102dfaee6a9e2f14c47085691214ba2e00ad7ec4a9789963807017232bc801080686d1bed1

Download Submit
C:\Windows\SysWOW64\Lndagg32.exe

Filesize
337KB

MD5
c037ea66ab27f596124f0ae4359a485e

SHA1
44e72f3cbdecaf5355e79930624ec19a74740de5

SHA256
d3a92145b3e94b6bf344679eb7d5683924d168b98c7c65af75c1f3bc02192ba6

SHA512
35749ff543cffb1273f7a76a04146c683195898ce4fc4fd6faa97b34d4e4b159f6253ff563dde1b6592a09c18ff4ba2bbcd8ab2258ecc6b0032e89ec6874397a

Download Submit
C:\Windows\SysWOW64\Lqikmc32.exe

Filesize
337KB

MD5
518ff27ee92e917b6019be53c95a9271

SHA1
639b7d6778a4ef95a8a7f364c9b07b13216dc450

SHA256
1475bed3626dc48b4855c3e3565ef1bfab2424a3dbed5a46444a3874ae982f28

SHA512
a1792bec8326344484f61b7d259aad3d3e671c81e08a24125abe7e597c8778e68334d5888f06d3e95fc4def75abfc1da638ba24290305abb03bc4b2f810a7245

Download Submit
C:\Windows\SysWOW64\Lqmmmmph.exe

Filesize
337KB

MD5
746da144d4717221ad4e787b5cdbb8ef

SHA1
1fd20b1e0adc0dccb6ac5898e8c85df183abfa34

SHA256
398de9f20965705d9fbeac2e9bdc84dff255a28fded9b20e9e8175a91d1f69c1

SHA512
5d292f684715e32d2fc365a307ba715ec83152cd4ae15a2624ab2953521841022484a6c6dcd64fd47a77ab823e219d1335d0066547534c5d50ba6bc4230923a6

Download Submit
C:\Windows\SysWOW64\Maeachag.exe

Filesize
337KB

MD5
3c6b98fb0cb567e8e1161a4a358fe7c7

SHA1
9bfacaba60710beebe250f0a2cca946d550a427d

SHA256
288fb1791fb1e6e867b78745c1444d9a519b310041965bcc823d85f08f0b2dba

SHA512
a155d0f24efce5a923410638b49008e08c0019496a0b68c646e18752dc64383fa23d3a6ef2de6f192d2d930bfa893520660eae53b5a331e418990b9c0a54ca37

Download Submit
C:\Windows\SysWOW64\Maodigil.exe

Filesize
337KB

MD5
3ba6878518c3dfb98d0dedffd3e29f28

SHA1
0ff4ef7418d8546047b38ffe16797c1148ab59ee

SHA256
0b4f507dfaf70cf69e5222d79c7ef438af96a1edd801d5f4034c7d3b01bff824

SHA512
849a6ae494a3456d2fbfa86638fe57f12477622755115f705eb1dbd105146749fdc2271f9c08c5ea54524018c8770b4937568627b8c4078d0dcc344e033f76bc

Download Submit
C:\Windows\SysWOW64\Meefofek.exe

Filesize
337KB

MD5
c416140cefb3baa3ece384aa512f8271

SHA1
bb3bf7f64c2a23bc4a12f600898c7d3228660367

SHA256
fe91bd00b52a817e3c5fa55bceafc8e88b27d3891f1b0144e7ed9a09ace4d452

SHA512
468db9d710e40440db3344195d56334299d48f8f366c83e7e3eb06f7623ad8484bde3f42e22ee6e7ae24f9cc0f4169842a636b7df80fcb66e2bd7007bf58e24d

Download Submit
C:\Windows\SysWOW64\Meepdp32.exe

Filesize
337KB

MD5
8cd1b147f324f513242528b0701cba7d

SHA1
4ebbbbe17b4e132f348c3634a1a61fd011813591

SHA256
797dfe441dc153eb2da3fcd17981401df9632a991545502a5bea62ad87f90d0f

SHA512
ec2b0395b079b96d5bc8aa1b3cf671046c4102a976f1247b22b7e16c5d19f5f2f30123293bd3b29f39e7906cfa9591bac2a6ffb3b22381b761806f20f4ad71d0

Download Submit
C:\Windows\SysWOW64\Mlbkap32.exe

Filesize
337KB

MD5
9f8166382153c32adb4647b54e55aae5

SHA1
a6d0c73ae41038f9e50ea6b36041b514f43d845f

SHA256
925fd979486c223654234096f06ed075392edd221f5827b7f64b1700c52fdce2

SHA512
337d6a9bc0e4b383d72d1848c0c2214af751034dd815643e503b043cd2416f7f3c038c54fbc3ccb9a28c7e67bf806a7f8df940503014eb2c3192a6ebad043bc9

Download Submit
C:\Windows\SysWOW64\Mlmbfqoj.exe

Filesize
192KB

MD5
dc0821e517ca506e994513d089f19c51

SHA1
1cdb3bfa67b09dfc3f1eb1a7d8e2785f3735efa5

SHA256
a0f1414e893590e008315872b5dfc6e182fae129976abfb5342b2488e8edbbb5

SHA512
c044999f87de9aed0586d4881b5adeb0660c0d9b7c326d833429cfb3e500f0ccf10b7b6695a7f50a545b9e832ec55d61f6f8bed1d66fb791fa946155bf47a3f8

Download Submit
C:\Windows\SysWOW64\Mlmbfqoj.exe

Filesize
337KB

MD5
b2ccfa4d6df2e8c5252f9fed087bfd2c

SHA1
9fe9d646ddc73225a7108699248a6a979e6b9179

SHA256
90ee260fb73cce2b50f6a78c546762371ba006d37e59941d7762b94765356947

SHA512
cbbacefb234f9a81cb0b7c3da31db1ef60fff540a6f3b9a1815302b0b18891a3b257c523f7e812cd2fcf52954555baf546ba5d6d6ae0a0e23b592f05a49efb19

Download Submit
C:\Windows\SysWOW64\Mmbanbmg.exe

Filesize
337KB

MD5
1eba975c55383d471a278188bb6f3469

SHA1
7246ba713c6e9994e2c8a4aeab7cfd9d6c12fadd

SHA256
1423b6505054ee8316f7338026a770d6ac339056766e3c395bb1ada1519ad739

SHA512
66ec75bfe01bea358af98aa3ce4472b5e2f0dc46e131e45b0a74141076151798f104650f2a3842dfa2e166cc5b7ef6d1bd54bd5f0d4e1680823c7be143ceef44

Download Submit
C:\Windows\SysWOW64\Mniallpq.exe

Filesize
337KB

MD5
600471cfec2fe38ba5d27ea921188c8a

SHA1
ec2b22dbad1a8bf9743f348cbef5155f869bbb9e

SHA256
54f52e057e4a2e34d2c60e8f6f6a2853838dac1fce3f63c9f986c11da853d845

SHA512
0471af50f080236a71d22cd502ac327ca1b088d875ab8b99816554b5faf9a7ee47fff4b44e792b3986bef46c548f8687afd3ccd0884b02317c64ceb0874305e9

Download Submit
C:\Windows\SysWOW64\Mnnkgl32.exe

Filesize
337KB

MD5
49a78cf6f7b6d6f5fab00fc7a81623b1

SHA1
f204841548fd157de4209f86c751b3c2e75c1d78

SHA256
ed34809e6c0776d6be6ad72a7eb910b77583a841b3e2b5a8fd4ecd24da022e16

SHA512
ff788e6fcca24fcf8dc079d224dc352389ec3756003b775babdc43f843397ff77ab09424edff0073958e18ebfeff323a49d9f0a99fa3825c693d41e77bc9187a

Download Submit
C:\Windows\SysWOW64\Modgdicm.exe

Filesize
337KB

MD5
bf65e2f13c37cb66ccb873a133eef340

SHA1
02215125befaaef6ce2e35515a92528caf7a5277

SHA256
ed4af11140b6557e88204d20c6e9a8f96b22dfad950751bf72a2de615c160864

SHA512
582335123efbe3450fdaad4ccf3a4862e4a9b787260e6237050cb42016bc4ca7031308fa3667d11bc735dad93595816177c4477d00f19676ea3a67aba7756c4d

Download Submit
C:\Windows\SysWOW64\Nafjjf32.exe

Filesize
337KB

MD5
ec2161a4585fa4d7e77556dcf66558ea

SHA1
9753dc764edb1da291fcd077bb8d3c016cd243f8

SHA256
8bdd32121c3adbd13b9112814be06497bcfb6f75ac3f95ccc74fc84161dc7bb6

SHA512
a431bb5db80a12ddd025e4c946d88439c68660301f6eeadbd7ba90d2f2844c198a93fafc4e8ed43bdc2b2e3c2ff11f7ad51282c26fd21d451974560c5a7c0bc6

Download Submit
C:\Windows\SysWOW64\Nbefdijg.exe

Filesize
337KB

MD5
915d6688d6d5c8aa6f7e50b401e13bbd

SHA1
f78de66437423b817a76395ca3ab8069c5356903

SHA256
d25c2ffd7ad1e54a4f0c381695d9bc10169509edb79b01bef340b86fe6ee3357

SHA512
89665a31dfe7dad86d777c082e55706e451e6dd613353fcb79bbd5a85ec13ee32c4432d718ce3495312441d5a04e95095d4a17805cb676cf3a854e7d2341656e

Download Submit
C:\Windows\SysWOW64\Nbgcih32.exe

Filesize
337KB

MD5
1281a38a56f7b9c6fe8057b3cf2bb258

SHA1
c1028fc5a5d4f6d8e9baca0dbc8aacd13cf9f690

SHA256
0187ea48b1c735730ba79daf306c62d4aad5dcc79cdfccacfc8163f8f097a18b

SHA512
2d1c17f30d77b6e966f6658d247975b6f7880cb344a5a44b7522f778849e95f5263bcbc780584fc99fc8baa068b5844af5ed1b9b0c3fad3072e702e08a198186

Download Submit
C:\Windows\SysWOW64\Nefped32.exe

Filesize
337KB

MD5
a9fb6abdc2f07e4add5c44d858f09888

SHA1
fe79bd26424686db9d7091914abb9cd12fbb263a

SHA256
ef990f6ad2b7e44a5482ac251a136d784bd7ffe8a7a219d92165095ad08e441c

SHA512
74b58b046faea71960db39701523f622668e72d41989641b83481e9cba7091c749ea90ee4a283d653e486a15572f30600e9b8efc98458393925f72b387c86464

Download Submit
C:\Windows\SysWOW64\Neoieenp.exe

Filesize
337KB

MD5
bfc6d73ae11b6a617799c46d7e4cd2d4

SHA1
13a2789217b59ddf196382e91cd6401865ac3303

SHA256
b4112e687eaa5c242789071544e30ceb87593e76967bbb27af1c742efe76d9c2

SHA512
b174a8a18fcf1a51d681e90487845b01b7a8dedabfa54013f90d721eff451f126990a46a16900df03b368936a2b2057079e095ff7ced0947f97ce5ed4e9bee07

Download Submit
C:\Windows\SysWOW64\Nhbolp32.exe

Filesize
337KB

MD5
ec0395dc4b83d045a93d70d222729ea8

SHA1
06ed625c9275aec8d522e912e5c0d57cdfea2fde

SHA256
9ad782080f0867d0280ce7b6cf8a7f8d311c03823b01d942d3cc1da72606f0c7

SHA512
d6ca6117d0bc43fd52e3f1a3975adb6adf6b14a4c096ae827a6a63dd8bb526ef19749800b6c40a3e3d1c60b3c769910b6743f9fa68e1d8c52e86acd53d06b9df

Download Submit
C:\Windows\SysWOW64\Nhdlao32.exe

Filesize
337KB

MD5
e120aa3fa1928f8c47616e5a6a247fc9

SHA1
915ab897c547d60f1ab4efa2784370f1b81882cf

SHA256
5c60d01c19793d798177dc271970503fb5d3264a952b6c350100614f4e488552

SHA512
c78515d212bd5c8dae9bc21562ee45db26164384f0d5a95c344edb934d3f363794ecb20319079f7c21d0ccee4b3035379570ccfcbf85262eed2545eb4b8f9545

Download Submit
C:\Windows\SysWOW64\Nhpbfpka.exe

Filesize
337KB

MD5
5052141b56d92772168d8234f8d9c668

SHA1
7b485568f04d8b7c2c6f50d8515faba5a359ac4d

SHA256
1c3211ecea0454f5a8b5622630fdc82668f2e25217aab4ea83a8043b31d1b982

SHA512
cd6d8ea7cc3b6e76ca1527ff09e60f456706fcd7cfbce301192f18f6e45a09b21112d7f8c27d97b9020dcaea4f9d57664fe23d43b8ef636da86344b93f2b1ade

Download Submit
C:\Windows\SysWOW64\Niakfbpa.exe

Filesize
337KB

MD5
d7eb9dfbc140d28424d970d4a7e09f1f

SHA1
2c2449d36a5c2c7f1ca1c274e4a7f3422bf2af40

SHA256
4091cd1e29ed1fc0c3863d713b94278b444ac7df4b2bcb71d0f113244ab15989

SHA512
7decc4ebe0a955dcd84d3c9444b2b747b5483a51e5eb06cbd2bbc623dddac79d5365e6f26dd1caf0f6388f59035c53718777b927ba70b879f139bf98efe328e6

Download Submit
C:\Windows\SysWOW64\Niooqcad.exe

Filesize
337KB

MD5
a1b437bf2afe7caca2a07936e76e5b9d

SHA1
6c64cae81323cf28cc6cab5d11df758b4acb322e

SHA256
1f33bd9b5e282c85de618fc719f90b1ea8f8246870e37cc480dd143027045257

SHA512
097dc83060f0c1292a1921eea57fe3a7b2f1177caff030947fd41122ae2f1e3767da668684aba583e5844bc7ff7bda88a09c53fb65b61628493963ac4e2cfabf

Download Submit
C:\Windows\SysWOW64\Nkqkhk32.exe

Filesize
337KB

MD5
5b1e550e56b78532e2f7fb25b5cfdf6c

SHA1
7033dda79f3f14f9bb1eff165be60143a12062ef

SHA256
b6e6577d3df08c0aab603b334834b516a9298b747d4bb4c1414d24ccf7d1101b

SHA512
d76d9a2c422a16186a6e160ede5751b3ea45ade98e770c0b7cda54549e8d068c0f2e0a4c4add67177adfb30255470661135a4f675dceb2221b670aa17a8f68e0

Download Submit
C:\Windows\SysWOW64\Nlfelogp.exe

Filesize
337KB

MD5
b0e33d6feaef1b9c40836e74b2d760a2

SHA1
91e0c35fea370d66ecad3d64b00fdee733e4d71c

SHA256
945c2b5a654fd8ff0be7f7789019a40d98b7e158be2c99dfb3d09863d930ba3b

SHA512
35a1166e2e7c3da0a19bc5c854645bc2e2522b602d3b2f2ccc653178f51b6ba730ad8360c3038ca8d507c7dfb8752e64de5295febd429565eeb1f2bbf1b15286

Download Submit
C:\Windows\SysWOW64\Nliaao32.exe

Filesize
337KB

MD5
623d64367e7e05fa4dd7441d128b3b66

SHA1
bb77aa7c8baa047256f7917df5b88b1c25aa70e5

SHA256
2f3114f7b7835eb6ce0e7284c4b1d2b20d7504999fdfda6be37828c4f1c170dc

SHA512
86a30f5883aa52ff0d89734d5d1c99c1fc330657ec3da346eb4aa565b5785365fd06854a63fa29689aa7bcc94712201350158989558393fc870bed8881835e07

Download Submit
C:\Windows\SysWOW64\Nlkngo32.exe

Filesize
337KB

MD5
b4ef542d054b700bba180d128c0a0c84

SHA1
cbff368b293b11a56e1a149037d2c3bf2a2d71c3

SHA256
27080ac777ef3c39534117dba212b8f6f44567e7bfcf7218108f6fca187b64fa

SHA512
1c018dcb62d67b78b932f451116976ca8cc244b524811c3e2add0493afb2bf91549059a4e41e0a1567956da1f081324518961debdd3ab9e0d81a4ca8d8b1f582

Download Submit
C:\Windows\SysWOW64\Nnfgcd32.exe

Filesize
337KB

MD5
a3b099f1782fb8b8e2e80ee2dfe2f39e

SHA1
fdda1221978761aef0de556c3c65695d2587632f

SHA256
da30739afd72989a136afe6beeee228dad9aca7e5ab5d9692e99d3472c55d414

SHA512
f0256fa0eccf0b0663827bfb51f82e0d581fa768502f97da0fcd1c7d70b9cbed2ee8ef8cde0143c761df8c221be42cc8ae4e85bb0c76814cf619382f93953304

Download Submit
C:\Windows\SysWOW64\Nobdbkhf.exe

Filesize
337KB

MD5
f2e97354c09a5333f34ee92b78406fe0

SHA1
28464014582a2180bbd33ef832beec77d74559ed

SHA256
095593e8849bc70def3757091b203ed8907fefe56558f21928475d177b3ff557

SHA512
9067c749eb249440615c8344acf9e8cf86b36c5fcfefc4be0e01e64caf424472088a1a138570ecb32c66fde64306500ce22fc001deee61941134b252b35f178c

Download Submit
C:\Windows\SysWOW64\Nojjcj32.exe

Filesize
337KB

MD5
9d7b63d487206394d31320817e65c4f4

SHA1
d57cae2a03bc34ef6b476b65a99a393bac8408f7

SHA256
a51363046ae5cbfc9cd2246760bf47134fde68b49072b1573b9d7e233a37e7cd

SHA512
cb5f51c7248b95c11f2f5290ed843aab8a3cb90ecfb3932d5eb140b8d4b144cd937219c0e9cdd49ca3f04eba6722c1083f287d587192c0aae0982d49f88d7545

Download Submit
C:\Windows\SysWOW64\Nolgijpk.exe

Filesize
337KB

MD5
4233cdf733bc87fbf7891cb4c877e432

SHA1
10d1e972d051f6c63b3b22eb04b608bb12088f44

SHA256
cfc0a9f458297a6655a4ea3ae81ff782ba4c382227eca9fb571421285ff36be2

SHA512
1b31102e8621b97633be19a7fd489b05aba223ca2ad53d45e69ffe0bcf99e26f9510acc1767391728e4bee5ba4a7a1854b0dc1ec375934ad6ae44f9cc1e49789

Download Submit
C:\Windows\SysWOW64\Oampjeml.exe

Filesize
337KB

MD5
1cbaade0a8ce060e29a3bb6a0e0e2215

SHA1
6744145614aba6ebc51167e7ecaf8b4dfd76c951

SHA256
60a5e94355363045df88821422a926b127d917317c7a9c1bddf28c47bbab9f22

SHA512
78e9805f4c30e30c7209b4e10b829ef6d143ef883e98fe48b7fdb8c22520544e09071b69c5244c8ccd8e489164e1ead0d1aec81657d00bde4bb21fd927c76217

Download Submit
C:\Windows\SysWOW64\Objpoh32.exe

Filesize
337KB

MD5
32fc1759f1ef3622a5a211e0f33cca2e

SHA1
6c1bcba1ed6fe2577c8fa4bc607f1e1239e438eb

SHA256
c22ca5a90575d81c6ae623a1486b6ca29b1328245753f89d35c964566d05a7b5

SHA512
3f714c35d9c48883b6d8100a4473e6e4b0605cce8653f8f8f20ce59c24506a115a3257649e4da1c83f272727df9d49c7f3b7aab4cdd7e144d54f5c728c84e679

Download Submit
C:\Windows\SysWOW64\Oidhlb32.exe

Filesize
337KB

MD5
98391e18420c94845c33779701df5dfd

SHA1
e9f060303fb58f0915270196960d196056c629aa

SHA256
b4e4a1bedfc51544893c99f3672d669f6e7bc276dfec78a6dd7354f60d3ad6cb

SHA512
f610c9bc91bce5311196c717272d50fa54075d878f85c7058321c0b0aeaf67138e73929749b41fbf99a4c3e679385ba1a920eeeab43fc7a71c3895605a93213d

Download Submit
C:\Windows\SysWOW64\Ojgjndno.exe

Filesize
337KB

MD5
cf383b81941a586adb27e352a62173d8

SHA1
ee386cc5620a75010439f61cc5ca4a92a1eebbd5

SHA256
145fb6c74d2e84ad874af854db16e45c5b3c7ce7184621c45134854cdb2a12bb

SHA512
aec8caec7278fb6b574df318d8187c10e7b2038f225e4582ef8365a78b4f18c19396dc2f3055339378f955440466e648b9fb489c6a4ada75a2aa23e9929945bf

Download Submit
C:\Windows\SysWOW64\Okchnk32.exe

Filesize
337KB

MD5
dec081ec4a61aa5d9d5007d572fc5a10

SHA1
8c4c64c2d6e46d01da9db6b837c4726aa1552480

SHA256
9925e8f196ad5ffc41c3ddc97c7edebbd2f69475f480a8be8cd6ca749d6b3839

SHA512
6fbd650af2dc4bc0b35764eafbcc8341a68b6bf37cfee6dc2d40cc010c652e7314ab761df22b295725df4a26c74dc01a483152a3764609fbbc341006a2094da1

Download Submit
C:\Windows\SysWOW64\Olanmgig.exe

Filesize
337KB

MD5
40cc9863cd19babaa694540bbd4f7edb

SHA1
43415811c25f6332927dcfd7aaec9d59fa34356a

SHA256
9bf2d36fc42687cf6a01072f839e63a65281494e882933d5b52822a01933e06b

SHA512
b83a8ef80c3adcefdacd5ee0ed7937fec8bc3b2b4905d8e0624227e0c629601506f503f83b6c682882ce4b42920baa6dbd605681d8f65e0be60c8c4766dda725

Download Submit
C:\Windows\SysWOW64\Omnjojpo.exe

Filesize
337KB

MD5
7a21d2e86f70c94b891215574b3a6fff

SHA1
f4af5b6ec631a3cc490238ad0c82cac1286d81f1

SHA256
842ec9b659a4951052eef932e2c4e84e0d577dbe656e874ed15adba7b6e9129e

SHA512
72e8952878d1be0fa801dbea939b901f85e5f8fc4661cce54f95ef109f7a6b53d9ba2a38a44694a3368c50b559ce0e493bef6028d6439c1cba5a363fbd252e60

Download Submit
C:\Windows\SysWOW64\Oondnini.exe

Filesize
337KB

MD5
a669d7c597775a93802e1cf0ec810744

SHA1
a9827b2061aa78971b6251e187fa4516a2e97f64

SHA256
46905fe87b453a091b900086ece15c1e41c75fa8fa2e810920b58ec345fa7dda

SHA512
de62d1e7b88953cb173d229a63bb6d513b65317a1146383f041889ab18afcfc1897863cee9e7398d14841c94aaad4487942b45f20c3c3a8f66c622484d3e8117

Download Submit
C:\Windows\SysWOW64\Paiogf32.exe

Filesize
337KB

MD5
7c231aa5ba64614d9d23a0d57f7e4d89

SHA1
5950cd9d871ff515d9b0a83d3e0c5a9fe396789e

SHA256
5f76bc26b04f19466ba504c078772752692f7b6df22a6fe3bd9378f45e8a876d

SHA512
06fd69622010fd619688d9dda9900b30e1d43f607e48bd46f0c5d7ba26d1223fe58cc5534724325e0c8c8d41ef08e7c3d913a0e3520752fac796e9dbd841369d

Download Submit
C:\Windows\SysWOW64\Paoollik.exe

Filesize
337KB

MD5
417c0d88814284a4ce3ada6368368d64

SHA1
428adbe10ddc331aff926aadb37505871595716c

SHA256
26fc1a0e92209763a03b4d73699054001785ef6f680296328173af912a418198

SHA512
5e920539728888ebf76a5a73d390fd4b2d8c00ea0e953c6bf6457a42fb859691ab8db38f1dcf2fca449028aa4141c18ad581646e9b43bb2f08990d29624d5d66

Download Submit
C:\Windows\SysWOW64\Pdjgha32.exe

Filesize
337KB

MD5
c3ae93b9dcc9b62c8f3acef1c88a1a6a

SHA1
d413644d26142304620d76f439a331b45b29b95c

SHA256
0d24d603bb55814376e464d148b08b2a3d71601d3f4544a2558d9d05fcda1d67

SHA512
c0c9314ecc4534dd79df5d3929a3fccb4d762d826ab30b2701d741ba8d2447ca3f42fa6fb463d45d6fb3a46b5d249aca7af3f50346949cf7baa370d596b68b14

Download Submit
C:\Windows\SysWOW64\Pjbcplpe.exe

Filesize
337KB

MD5
e57a6a369f7e3d18b3482b87b5240c2e

SHA1
2c877121e22a95b0097ecc25a598412713872aca

SHA256
1f4baecdc4d8a05a25db1ab9b8e84e5ee524f5020fb1609f55d702a7961408df

SHA512
3be5ced0b1935e5fd9c9f9bf360e5c8273ec57445682cb88d42dc86e01433492c74a4d012c94e8d211c20b46901da0711532b6a08a3fec47de0618665eca35c7

Download Submit
C:\Windows\SysWOW64\Plpjoe32.exe

Filesize
337KB

MD5
054611abdaf72a5460c5aede75cd50ad

SHA1
2b8afcc67fb9beb61690172d3d023a9cbe3bff3b

SHA256
2e70dc18a674892d3ff37cdd083419c857b95cf1c226c5463cd2d68015bc9dcf

SHA512
5acda384d4b533edfc1abfb37b03396fa000656effb7f9db0f18e961c7dee761d0b5013c066680be99caf157b7379111cb0e9e6d605edf38104691f8bc8e74da

Download Submit
C:\Windows\SysWOW64\Qfmmplad.exe

Filesize
337KB

MD5
9c421a611dd95f2385a244dd9c981c6c

SHA1
8a21fbe4a9bb7ff9572d498bdd845213793bba57

SHA256
677772198d194d367b4733c21f0d7a646350e419156a265a2db639aaefd56bf0

SHA512
75030b9b1a4e9cd7a025c90b858e5476a59296799a802118fad73e61bf91fcbc55a31c56dbcaae91d87366b377c3d60166303fdc417eb27570f9626e1799e772

Download Submit
C:\Windows\SysWOW64\Qhkdof32.exe

Filesize
337KB

MD5
c9f5be5da7f9740b780e75e7426d3c76

SHA1
23b2031cdd89039469acab904ffdbe411857bea9

SHA256
834c1f5a03bd5cd0149d32ba8cc8d8bd36f0c844a7e9436a6a292c5ac39fdb68

SHA512
0c09d2add5096c1ad2a6a520819653795c9cf2fb7e3913dde825c24494c9571fc4d4e16568af3175819ac32d71561d1a658dc71bbaab3cf86a09beba5fe3df6d

Download Submit
memory/428-261-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/432-279-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/628-447-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/632-309-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/636-501-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/740-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/740-591-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/752-345-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/848-149-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1028-285-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1036-197-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1072-519-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1400-578-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1472-229-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1496-339-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1556-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1564-571-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1656-375-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1672-327-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1800-598-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1800-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1824-173-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1912-489-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1944-441-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1948-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1964-544-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2032-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2240-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2412-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2424-267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2504-315-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2616-387-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2640-471-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2700-483-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2752-133-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2820-564-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2936-297-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3000-550-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3016-531-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3020-165-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3028-205-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3092-453-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3128-423-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3312-577-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3312-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3344-333-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3352-543-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3352-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/3352-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3388-351-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3396-393-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3428-563-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3428-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3436-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3440-253-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3480-141-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3624-363-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3680-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3684-429-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3696-507-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3812-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4000-435-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4064-213-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4100-525-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4160-181-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4188-291-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4200-459-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4284-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4284-584-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4316-557-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4324-303-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4348-417-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4396-157-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4412-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4420-465-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4424-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4440-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4440-556-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4504-381-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4532-405-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4536-221-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4540-399-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4564-189-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4588-477-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4724-513-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4736-495-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4740-585-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4804-357-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4824-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4824-570-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4884-321-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4936-237-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4996-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5032-369-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5060-592-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5084-537-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads